Privacy Policy

1. Who We Are

We operate the InboundFlip™ platform (inboundflip.cloud), which includes a Vendor Engineering Evaluation Portal that facilitates the formal review of third-party development agencies seeking to bid on platform engineering work.

2. Information We Collect

Information You Provide Directly

When you submit a vendor application through the Vendor Engineering Evaluation Portal, we collect:

• Legal agency name
• Primary point of contact name, title, and role
• Email address
• Corporate web portfolio URL
• Declared technology stack and database capabilities
• Case study text describing production deployments and relevant experience

Payment Information

We collect a non-refundable administrative review fee of $20.00 USD. Payment is processed by Stripe, Inc. We do not collect, store, or have access to your full credit card number, CVV, or billing address. Stripe provides us with a transaction reference identifier upon successful payment. See Section 4 for more information about Stripe.

Automatically Collected Information

When you access the Services, we may automatically collect:

• IP address (used for abuse prevention and rate limiting)
• Browser type and version
• Session identifiers (via server-side session cookies)
• Timestamps of form submissions and page visits

3. How We Use Your Information

We use the information we collect for the following purposes:

• Application Processing: To receive, store, and evaluate your vendor application credentials against our engineering requirements.
• Payment Processing: To initiate a Stripe Checkout Session and confirm receipt of the administrative review fee.
• Communications: To contact you at the email address you provided if your profile meets our evaluation criteria, or to respond to inquiries.
• Security & Abuse Prevention: To detect, investigate, and prevent fraudulent submissions, automated abuse, and violations of our Terms of Service, including IP-based rate limiting.
• Internal Analytics: To understand aggregate submission volume and evaluate the effectiveness of our vendor intake process. This analysis is performed on internal data only and is not shared externally in identifiable form.
• Legal Compliance: To comply with applicable law, respond to legal process, or protect the rights and safety of the Company and others.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

4. Third-Party Service Providers

We share your information with the following categories of third-party providers only as necessary to operate the Services:

• Stripe, Inc. — Payment processing. When you submit a payment, you are redirected to a Stripe-hosted checkout page. Stripe's collection and use of your payment information is governed by Stripe's Privacy Policy.
• Google LLC (Firebase / Firestore) — Cloud database storage. Application data submitted through the portal is stored in Google Cloud Firestore under our Firebase project. Google's data processing practices are governed by the Firebase Privacy and Security documentation.
• Railway Corporation — Application hosting. The Services run on Railway's infrastructure, which necessarily processes all data in transit to and from the Services, including standard connection and request logs. See Railway's Privacy Policy.

We may also disclose information: to professional advisers (such as accountants or attorneys) bound by confidentiality obligations; to a court, regulator, or law enforcement authority where required or permitted by law; or to a buyer or successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to that party's obligation to handle the information consistently with this policy. We do not otherwise sell, rent, or share your information with third parties for their own marketing purposes.

We do not use third-party advertising networks, analytics platforms, or social media tracking pixels on this platform.

5. Data Retention

We keep different categories of data for different, defined periods, set to the shortest period we believe is consistent with our legal and accounting obligations:

• Unpaid / incomplete applications (payment not completed): deleted no later than 30 days after the application was started, unless you complete payment before then.
• Paid applications — not selected: case study text, portfolio links, and declared capabilities are deleted no later than 12 months after the review decision; your name, contact email, and payment/transaction record are retained for 3 years from the payment date, consistent with general U.S. federal recordkeeping practice for business income records (see IRS Publication 583).
• Paid applications — selected / active vendor relationship: retained for the duration of the business relationship, and for 3 years after it ends, for accounting and legal-defense purposes.
• Payment and transaction records (amounts, dates, Stripe reference IDs): retained for 3 years from the transaction date.
• Security and access logs: retained for 90 days, except where a specific record is needed longer to investigate a security incident already underway.

These periods may be extended where we are required to preserve records for an active legal claim, audit, or investigation, or where a longer period is required by law in a jurisdiction that applies to you. They are U.S. federal baselines; if you are located elsewhere, a shorter period may apply under your local law, and you may contact us to ask about the specific period applicable to your data.

IP address data used for rate limiting is held in server memory only and is not persisted to external storage. It is cleared when the server restarts.

6. Data Security

We implement reasonable administrative, technical, and physical safeguards to protect the information we hold. These include encrypted data transmission (HTTPS/TLS), server-side session management, Stripe webhook signature verification, and access-controlled administrative interfaces.

No method of electronic transmission or storage is completely secure. While we take the protection of your data seriously, we cannot guarantee absolute security. If you believe your information has been compromised, please contact us immediately using the information in Section 10.

7. Your Rights & Choices

Depending on your location and applicable law, you may have the right to:

• Request access to the personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Request deletion of your personal information, subject to our legal obligations; and
• Object to or restrict certain processing of your information.

How to exercise these rights. Email privacy.assurance@gmail.com from the address you applied with, and tell us which right you are exercising and, for correction or deletion, which specific information. To verify your identity, we may ask you to confirm details already on file for your application (such as your application ID, agency name, or corporate email) before acting on the request; we will not ask for information beyond what is reasonably necessary to verify you.

We will acknowledge your request within 10 business days and respond substantively within 30 calendar days of acknowledgment. If we need more time due to the complexity or number of requests, we will tell you why and give a revised date, not to exceed a further 30 days. An authorized agent may submit a request on your behalf if they provide written proof of authorization; we will still separately verify your identity.

We may decline a request, in whole or in part, where permitted by law — for example, where deletion would conflict with a payment or accounting record we are required to keep (see Section 5), where a request is manifestly excessive or repetitive, or where we cannot verify the requester's identity. If we decline a request, we will explain why in our response. If you disagree with our response, you may reply to ask for a further review, or, where applicable law provides a right to lodge a complaint with a data protection authority or similar regulator, you may do so.

8. Children's Privacy

The Services are intended for business entities and their authorized representatives who are 18 years of age or older. We do not knowingly collect personal information from individuals under 18. If you believe we have inadvertently collected such information, please contact us and we will take steps to delete it promptly.

9. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. When we make material changes, we will update the effective date at the top of this page. Your continued use of the Services after the effective date of any revision constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

InboundFlip™
State of New Mexico, United States
Email: privacy.assurance@gmail.com